7.8
Élevée
CVE-2022-4696 There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation
Description
There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Linux Kernel 5.7 | 5.7-rc1 → 5.10.159 | Pas de correctif indiqué |
| linux_kernel 5.7 | 5.7-rc1 → 5.10.159 | Pas de correctif indiqué |
Références
- kernel.dance kernel.dance
- git.kernel.org git.kernel.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Linux Kernel
Les 43 CVE de Linux Kernel →
CVE-2024-24864
A race condition was found in the Linux kernel's media/dvb-core in dvbdmx_write() function
5.3
Moyenne
CVE-2024-24857
A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function
4.6
Moyenne
CVE-2024-24858
A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function
4.6
Moyenne
CVE-2024-24859
A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function
4.6
Moyenne